CVE-2026-107314

The pgjdbc PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 , contains a vulnerability where the requireAuth connection property fails to enforce restrictions if all six known authentication methods are excluded (e.g., requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none). In these ...

CVE-2026-89322

Vault and Vault Enterprise are vulnerable to a flaw where ACL policies are not consistently evaluated against the canonical form of resource and policy names. This CWE-178 (Improper Handling of Case Sensitivity) issue allows an authenticated user with delegated permissions to bypass explicit deny...

CVE-2026-89322 Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions

Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy,...

CVE-2026-105820

The Vault ACL policy cache is vulnerable to a path traversal flaw (CWE-22) when policy names contain specific traversal constructs. This allows a token with a specially crafted policy name to bypass namespace boundaries and utilize the capabilities of policies defined in other namespaces, includi...

CVE-2026-105816

Vault and Vault Enterprise are vulnerable to arbitrary code execution on the host because the software does not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. If Vault utilizes Shamir seals and an external plugin directory , a pri...

CVE-2026-105816 Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots

Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage Raft...

CVE-2026-107285

The AsyncHttpClient (AHC) library, used by Java applications, contains a vulnerability in versions prior to 3.0.12 and 2.16.1 . The root cause lies in how NettyRequestFactory.newNettyRequest and requestUri determine whether to attach proxy authentication; because ws is not marked as secure, tunne...

CVE-2026-107285 AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy...

CVE-2026-107284

The AsyncHttpClient (AHC) library for Java applications contains a vulnerability where WebSocketHandler.upgrade fails to properly terminate a handshake when the Sec-WebSocket-Accept value is missing or invalid. While the handshake is technically aborted, the library continues into pipeline instal...

CVE-2026-107284 AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebSocket-Accept value is missing or invalid but continues into pipeline installati...

CVE-2026-107283

The AsyncHttpClient (AHC) library for Java applications is vulnerable to reduced authentication security due to the use of a non-cryptographic random source. In versions prior to 3.0.12 and 2.16.1 , the Realm.Builder component generates the HTTP Digest client nonce using ThreadLocalRandom instead...

CVE-2026-107283 AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest...

CVE-2026-107282

The AsyncHttpClient (AHC) library, used in Java applications, contains a cross-host request replay vulnerability in versions prior to 3.0.13 and 2.16.1 . The root cause is that request replays update the current request but retain the target request and proxy context of the original origin. This ...

CVE-2026-107282 AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original...

CVE-2026-105818

The Vault PKI secrets engine ACME server is vulnerable to an issue where it fails to restrict certificate identities that ACME challenges do not validate when using the default directory policy . This flaw allows an ACME client to obtain a certificate containing unverified identity claims , poten...

CVE-2026-105818 Vault PKI ACME Issues Certificate With Unvalidated SANs

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

CVE-2026-107281

The AsyncHttpClient (AHC) library, used by Java applications for asynchronous HTTP requests, is vulnerable to an identity mismatch issue in versions prior to 3.0.13 and 2.16.1 . The root cause is that the HTTP/1.1 connection-pool key omits the authenticated principal for NTLM and Negotiate authen...

CVE-2026-107281 AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, the HTTP/1.1 connection-pool key excludes the authenticated principal for connection-oriented NTLM and Negotiate authentication. A pooled...

CVE-2026-107280

The AsyncHttpClient (AHC) library for Java applications is vulnerable to a cookie injection or overwriting issue in versions prior to 3.0.13 and 2.16.1 . The root cause is that the ThreadSafeCookieStore component validates Domain attributes using domain matching but fails to reject public suffixe...

CVE-2026-107280 AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such ...